Skip to content

Instantly share code, notes, and snippets.

@ram-pi

ram-pi/ca_validation.md

Forked from genaromadrid/ca_validation.md
Created July 16, 2024 11:28
Show Gist options
  • Save ram-pi/6a66eb4f6fe35b4604037478d0458b41 to your computer and use it in GitHub Desktop.
Save ram-pi/6a66eb4f6fe35b4604037478d0458b41 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @genaromadrid genaromadrid revised this gist May 12, 2016. 1 changed file with 1 addition and 2 deletions.
    3 changes: 1 addition & 2 deletions ca_validation.md
    View file
    Original file line number Diff line number Diff line change
    @@ -53,9 +53,8 @@ openssl dgst -sha1 -verify $root_pub_key_path -signature $sig_path $tbs_path
    ## Notes

    > The TBS certificate is the body of the actual certificate; it contains all the naming and key information held in the certificate. The only information in the actual certificate that is not held in the TBS certificate is the name of the algorithm used to sign the certificate and the signature itself.
    The TBS certificate is used as the input data to the signature algorithm when the certificate is signed or verified.
    > The signature of the certificate contains the fingerprint of the TBSCertificate
    > The TBS certificate is used as the input data to the signature algorithm when the certificate is signed or verified.
    # Links
    - [OpenSSL RSA Util](https://www.openssl.org/docs/manmaster/apps/rsautl.html)
  2. @genaromadrid genaromadrid revised this gist May 12, 2016. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions ca_validation.md
    View file
    Original file line number Diff line number Diff line change
    @@ -55,6 +55,8 @@ openssl dgst -sha1 -verify $root_pub_key_path -signature $sig_path $tbs_path
    > The TBS certificate is the body of the actual certificate; it contains all the naming and key information held in the certificate. The only information in the actual certificate that is not held in the TBS certificate is the name of the algorithm used to sign the certificate and the signature itself.
    The TBS certificate is used as the input data to the signature algorithm when the certificate is signed or verified.

    > The signature of the certificate contains the fingerprint of the TBSCertificate
    # Links
    - [OpenSSL RSA Util](https://www.openssl.org/docs/manmaster/apps/rsautl.html)
    - [A very good explanation of Certificates](http://docstore.mik.ua/orelly/java-ent/security/ch10_04.htm)
  3. @genaromadrid genaromadrid revised this gist May 12, 2016. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion ca_validation.md
    View file
    Original file line number Diff line number Diff line change
    @@ -45,7 +45,7 @@ openssl sha1 -c $tbs_path
    # Since the CA signed the DER format of the TBSCertificate, you can just
    # verify the signature of the certificate with the public key of the root
    # passing the TBSCertificate as a param
    # If everything its fine you'll get a 'Verified OK' message or a 'Verification Failure'
    # If everything its fine you'll get a 'Verified OK' message or a 'Verification Failure' instead.
    openssl dgst -sha1 -verify $root_pub_key_path -signature $sig_path $tbs_path

    ```
  4. @genaromadrid genaromadrid revised this gist May 12, 2016. 1 changed file with 12 additions and 4 deletions.
    16 changes: 12 additions & 4 deletions ca_validation.md
    View file
    Original file line number Diff line number Diff line change
    @@ -18,26 +18,34 @@ root_ca=intermediate_ca.pem
    root_pub_key_path=intermediate_ca.key.pem

    ### Extract signature from certificate

    # run the following and get the last bit position
    openssl asn1parse -in $cer
    last_bit_pos=819 # Put your own
    openssl asn1parse -in $cer -out $sig_path -noout -strparse $last_bit_pos

    ### Extract the public key of the root CA
    openssl x509 -in $root_ca -pubkey -noout > $root_pub_key_path

    ### Extract the TBSCertificate
    # Almost always -strparse param is 4
    openssl asn1parse -in $cer -out $tbs_path -noout -strparse 4

    ### Get fingerprint of the signature, the fingerprint of the TBS Cert and compare them

    # 1. Get the fingerprint of the signature with the root key
    openssl x509 -in $root_ca -pubkey -noout > $root_pub_key_path
    openssl rsautl -in $sig_path -verify -asn1parse -inkey $root_pub_key_path -pubin

    # 2. Get the sha1 (or whatever algorithm was used) of the TBS Certificate
    openssl asn1parse -in $cer -out $tbs_path -noout -strparse 4
    openssl sha1 -c $tbs_path

    # Compare the signature fingerprint from step 1 with the sha1 of the tbs certificate.
    # if they match, the certificate was sign with the provided rootCa

    # Or you can run the following and expect a 'Verified OK' message
    ### Other way to validate the certificate:
    # Since the CA signed the DER format of the TBSCertificate, you can just
    # verify the signature of the certificate with the public key of the root
    # passing the TBSCertificate as a param
    # If everything its fine you'll get a 'Verified OK' message or a 'Verification Failure'
    openssl dgst -sha1 -verify $root_pub_key_path -signature $sig_path $tbs_path

    ```
  5. @genaromadrid genaromadrid revised this gist May 12, 2016. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions ca_validation.md
    View file
    Original file line number Diff line number Diff line change
    @@ -12,10 +12,10 @@ openssl verify -trusted ca_root.pem -untrusted intermediate_ca.pem certificate.p

    ```bash
    cer=certificate.pem
    sig_path=signature
    sig_path=certificate.sig.bin
    tbs_path=certificate.tbs
    root_ca=intermediate_ca.pem
    root_pub_key_path=intermediate_ca.key.pem
    tbs_path=certificate.tbs

    ### Extract signature from certificate

  6. @genaromadrid genaromadrid revised this gist May 12, 2016. 1 changed file with 4 additions and 0 deletions.
    4 changes: 4 additions & 0 deletions ca_validation.md
    View file
    Original file line number Diff line number Diff line change
    @@ -36,6 +36,10 @@ openssl sha1 -c $tbs_path

    # Compare the signature fingerprint from step 1 with the sha1 of the tbs certificate.
    # if they match, the certificate was sign with the provided rootCa

    # Or you can run the following and expect a 'Verified OK' message
    openssl dgst -sha1 -verify $root_pub_key_path -signature $sig_path $tbs_path

    ```

    ## Notes
  7. @genaromadrid genaromadrid revised this gist May 11, 2016. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion ca_validation.md
    View file
    Original file line number Diff line number Diff line change
    @@ -21,7 +21,7 @@ tbs_path=certificate.tbs

    # run the following and get the last bit position
    openssl asn1parse -in $cer
    last_bit_pos=819
    last_bit_pos=819 # Put your own
    openssl asn1parse -in $cer -out $sig_path -noout -strparse $last_bit_pos

    ### Get fingerprint of the signature, the fingerprint of the TBS Cert and compare them
  8. @genaromadrid genaromadrid revised this gist May 11, 2016. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions ca_validation.md
    View file
    Original file line number Diff line number Diff line change
    @@ -44,5 +44,5 @@ openssl sha1 -c $tbs_path
    The TBS certificate is used as the input data to the signature algorithm when the certificate is signed or verified.

    # Links
    [OpenSSL RSA Util](https://www.openssl.org/docs/manmaster/apps/rsautl.html)
    [A very good explanation of Certificates](http://docstore.mik.ua/orelly/java-ent/security/ch10_04.htm)
    - [OpenSSL RSA Util](https://www.openssl.org/docs/manmaster/apps/rsautl.html)
    - [A very good explanation of Certificates](http://docstore.mik.ua/orelly/java-ent/security/ch10_04.htm)
  9. @genaromadrid genaromadrid revised this gist May 11, 2016. 1 changed file with 5 additions and 1 deletion.
    6 changes: 5 additions & 1 deletion ca_validation.md
    View file
    Original file line number Diff line number Diff line change
    @@ -41,4 +41,8 @@ openssl sha1 -c $tbs_path
    ## Notes

    > The TBS certificate is the body of the actual certificate; it contains all the naming and key information held in the certificate. The only information in the actual certificate that is not held in the TBS certificate is the name of the algorithm used to sign the certificate and the signature itself.
    The TBS certificate is used as the input data to the signature algorithm when the certificate is signed or verified.
    The TBS certificate is used as the input data to the signature algorithm when the certificate is signed or verified.

    # Links
    [OpenSSL RSA Util](https://www.openssl.org/docs/manmaster/apps/rsautl.html)
    [A very good explanation of Certificates](http://docstore.mik.ua/orelly/java-ent/security/ch10_04.htm)
  10. @genaromadrid genaromadrid revised this gist May 11, 2016. 1 changed file with 5 additions and 0 deletions.
    5 changes: 5 additions & 0 deletions ca_validation.md
    View file
    Original file line number Diff line number Diff line change
    @@ -37,3 +37,8 @@ openssl sha1 -c $tbs_path
    # Compare the signature fingerprint from step 1 with the sha1 of the tbs certificate.
    # if they match, the certificate was sign with the provided rootCa
    ```

    ## Notes

    > The TBS certificate is the body of the actual certificate; it contains all the naming and key information held in the certificate. The only information in the actual certificate that is not held in the TBS certificate is the name of the algorithm used to sign the certificate and the signature itself.
    The TBS certificate is used as the input data to the signature algorithm when the certificate is signed or verified.
  11. @genaromadrid genaromadrid revised this gist May 11, 2016. No changes.
  12. @genaromadrid genaromadrid revised this gist May 11, 2016. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion ca_validation.md
    View file
    Original file line number Diff line number Diff line change
    @@ -34,5 +34,6 @@ openssl rsautl -in $sig_path -verify -asn1parse -inkey $root_pub_key_path -pubin
    openssl asn1parse -in $cer -out $tbs_path -noout -strparse 4
    openssl sha1 -c $tbs_path

    # Compare the signature fingerprint from step 1 with the sha1 of the tbs certificate, if they match, the certificate was sign with the provided rootCa
    # Compare the signature fingerprint from step 1 with the sha1 of the tbs certificate.
    # if they match, the certificate was sign with the provided rootCa
    ```
  13. @genaromadrid genaromadrid revised this gist May 11, 2016. 1 changed file with 2 additions and 3 deletions.
    5 changes: 2 additions & 3 deletions ca_validation.md
    View file
    Original file line number Diff line number Diff line change
    @@ -14,6 +14,8 @@ openssl verify -trusted ca_root.pem -untrusted intermediate_ca.pem certificate.p
    cer=certificate.pem
    sig_path=signature
    root_ca=intermediate_ca.pem
    root_pub_key_path=intermediate_ca.key.pem
    tbs_path=certificate.tbs

    ### Extract signature from certificate

    @@ -24,9 +26,6 @@ openssl asn1parse -in $cer -out $sig_path -noout -strparse $last_bit_pos

    ### Get fingerprint of the signature, the fingerprint of the TBS Cert and compare them

    root_pub_key_path=intermediate_ca.key.pem
    tbs_path=certificate.tbs

    # 1. Get the fingerprint of the signature with the root key
    openssl x509 -in $root_ca -pubkey -noout > $root_pub_key_path
    openssl rsautl -in $sig_path -verify -asn1parse -inkey $root_pub_key_path -pubin
  14. @genaromadrid genaromadrid revised this gist May 11, 2016. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions ca_validation.md
    View file
    Original file line number Diff line number Diff line change
    @@ -13,7 +13,7 @@ openssl verify -trusted ca_root.pem -untrusted intermediate_ca.pem certificate.p
    ```bash
    cer=certificate.pem
    sig_path=signature
    root_ca=rootCa.pem
    root_ca=intermediate_ca.pem

    ### Extract signature from certificate

    @@ -24,7 +24,7 @@ openssl asn1parse -in $cer -out $sig_path -noout -strparse $last_bit_pos

    ### Get fingerprint of the signature, the fingerprint of the TBS Cert and compare them

    root_pub_key_path=rootCa.key.pem
    root_pub_key_path=intermediate_ca.key.pem
    tbs_path=certificate.tbs

    # 1. Get the fingerprint of the signature with the root key
  15. @genaromadrid genaromadrid revised this gist May 11, 2016. 1 changed file with 16 additions and 23 deletions.
    39 changes: 16 additions & 23 deletions ca_validation.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,46 +1,39 @@
    # Certificate CA Validation

    ## The easy way

    To validate a certificate agains a certificate authority you just have to run
    ```bash
    openssl verify -trusted ca_root.pem -untrusted intermediate_ca.pem certificate.pem
    ```
    > You'll see a 'OK' message at the end of the output
    ```bash
    cer=spec/fixtures/certificate.pem
    sig_path=docs/signature
    root_ca=docs/rootCa.pem
    ```

    #### Certificate against an authority certificate
    ## The hard way

    ```bash
    CA=docs/Banxico/AgenciaRegistradoraCentral.crt
    intermediate=docs/AC2_Sat.crt
    openssl verify -trusted $CA -untrusted $intermediate $cer
    ```

    > You should see a 'OK' text at the end of the output
    cer=certificate.pem
    sig_path=signature
    root_ca=rootCa.pem

    ### Extract signature from certificate

    ```bash
    # run the ollowing to get the last bit position
    # run the following and get the last bit position
    openssl asn1parse -in $cer
    last_bit_pos=819
    openssl asn1parse -in $cer -out $sig_path -noout -strparse $last_bit_pos
    ```

    ### Get fingerprint and compare with tbs
    ### Get fingerprint of the signature, the fingerprint of the TBS Cert and compare them

    ```bash
    root_pub_key_path=docs/AC2_Sat.key.pem
    tbs_path=spec/fixtures/production-certificate.tbs
    # 1. Get the signature fingerprint with the root key
    root_pub_key_path=rootCa.key.pem
    tbs_path=certificate.tbs

    # 1. Get the fingerprint of the signature with the root key
    openssl x509 -in $root_ca -pubkey -noout > $root_pub_key_path
    openssl rsautl -in $sig_path -verify -asn1parse -inkey $root_pub_key_path -pubin

    # 2. Get the sha1 () of the tbs
    # 2. Get the sha1 (or whatever algorithm was used) of the TBS Certificate
    openssl asn1parse -in $cer -out $tbs_path -noout -strparse 4
    openssl sha1 -c $tbs_path

    # Compare the signature fingerprint from step 1 with the sha1 of the tbs certificate, if they match the certificate was sign with the rootCa
    # Compare the signature fingerprint from step 1 with the sha1 of the tbs certificate, if they match, the certificate was sign with the provided rootCa
    ```
  16. @genaromadrid genaromadrid revised this gist May 11, 2016. No changes.
  17. @genaromadrid genaromadrid created this gist May 11, 2016.
    46 changes: 46 additions & 0 deletions ca_validation.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,46 @@
    To validate a certificate agains a certificate authority you just have to run
    ```bash
    openssl verify -trusted ca_root.pem -untrusted intermediate_ca.pem certificate.pem
    ```
    > You'll see a 'OK' message at the end of the output
    ```bash
    cer=spec/fixtures/certificate.pem
    sig_path=docs/signature
    root_ca=docs/rootCa.pem
    ```

    #### Certificate against an authority certificate

    ```bash
    CA=docs/Banxico/AgenciaRegistradoraCentral.crt
    intermediate=docs/AC2_Sat.crt
    openssl verify -trusted $CA -untrusted $intermediate $cer
    ```

    > You should see a 'OK' text at the end of the output
    ### Extract signature from certificate

    ```bash
    # run the ollowing to get the last bit position
    openssl asn1parse -in $cer
    last_bit_pos=819
    openssl asn1parse -in $cer -out $sig_path -noout -strparse $last_bit_pos
    ```

    ### Get fingerprint and compare with tbs

    ```bash
    root_pub_key_path=docs/AC2_Sat.key.pem
    tbs_path=spec/fixtures/production-certificate.tbs
    # 1. Get the signature fingerprint with the root key
    openssl x509 -in $root_ca -pubkey -noout > $root_pub_key_path
    openssl rsautl -in $sig_path -verify -asn1parse -inkey $root_pub_key_path -pubin

    # 2. Get the sha1 () of the tbs
    openssl asn1parse -in $cer -out $tbs_path -noout -strparse 4
    openssl sha1 -c $tbs_path

    # Compare the signature fingerprint from step 1 with the sha1 of the tbs certificate, if they match the certificate was sign with the rootCa
    ```